CVE-2026-96431

Executive Summary

CVE-2026-96431 is a CWE-434 unrestricted file upload vulnerability in the /WebAgenda/download/uploadFile.jsp endpoint of Flowring Agentflow 4.0 (versions prior to 2023/03/24). A remote authenticated user can upload a file of a dangerous type and subsequently leverage it to execute arbitrary system commands on the underlying host. Any organization running an unpatched Agentflow 4.0 workflow/BPM deployment exposed to untrusted or low-privilege authenticated users is at risk of full host compromise.

Technical Analysis

Flowring Agentflow is an enterprise workflow and business process management platform. The vulnerable component is a JavaServer Pages (JSP) upload handler located at the application path /WebAgenda/download/uploadFile.jsp. Per the NVD description, this endpoint performs an unrestricted upload of a file with a dangerous type (CWE-434).

The core defect class is well understood: the upload handler fails to enforce an effective allow-list of permitted file extensions and/or MIME types, and it does not prevent the uploaded artifact from being stored in a location where the web/application server will process or serve it. In a JSP-based Java application, the canonical dangerous outcome of such a flaw is that server-executable content (for example, a .jsp file) is written into a web-reachable directory and later invoked, causing the server to execute attacker-controlled code in the application's security context. The NVD description explicitly states the outcome: remote authenticated users can "execute arbitrary system commands via a malicious file." This confirms that the uploaded artifact is not merely stored — it is executed, yielding command execution on the host.

Key characteristics derived strictly from the available data:

• Precondition: authentication. The flaw is exploitable by a remote authenticated user, meaning the attacker must first obtain a valid session/account on the Agentflow 4.0 instance. This lowers the barrier for insider, partner-portal, or self-registration scenarios but excludes anonymous internet-wide exploitation.
• Attack surface: the uploadFile.jsp HTTP endpoint, reachable over the network (the /WebAgenda/download/ path suggests a web-facing document/agenda module).
• Mechanism: upload of a file whose type is dangerous and is not rejected by the server; execution of that file yields arbitrary command execution (per NVD).
• Exploitation requirement: no user interaction is described; the upload is a direct request initiated by the attacker.

Insufficient technical detail is available in the supplied data to enumerate the exact parameter names, multipart field names, validation logic, storage path, or parsing routines of uploadFile.jsp. Those specifics are deliberately not fabricated here. The vulnerability is therefore described at the level of its class (unrestricted dangerous-file upload leading to code/command execution), which is sufficient for detection engineering and mitigation.

The absence of a CNA title, vendor advisory, CVSS score assigned by NVD, EPSS score, public PoC, Nuclei template, or exploit code means this assessment relies on the NVD description and CWE classification. Notably, CVE-2026-96431 is not listed in CISA KEV, and there is no evidence of in-the-wild exploitation in the provided dataset.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-434) and the NVD description. All technical references are limited to the endpoint explicitly named in the data (/WebAgenda/download/uploadFile.jsp) and the stated impact (arbitrary system command execution).

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-reachable Flowring Agentflow 4.0 instance (fingerprinting via page banners, the /WebAgenda/ path, or product-specific content). The attacker notes the Agentflow build date to determine whether it predates the 2023/03/24 fix threshold.

2. Access acquisition (prerequisite). Because the flaw requires an authenticated user, the attacker obtains valid credentials. Sources include compromised or default accounts, low-privilege self-registered accounts, partner/supplier portal access, or an internal user with minimal rights. No elevated privilege is described as necessary.

3. Triggering the flaw class. With an authenticated session, the attacker submits a multipart HTTP POST to the /WebAgenda/download/uploadFile.jsp endpoint containing a file of a dangerous type that the handler does not reject. Per CWE-434, the failure is the lack of an enforced extension/MIME allow-list and the absence of controls preventing execution of the stored artifact. The uploaded file is accepted and stored in a location from which it can be executed.

4. Execution / payload delivery. The attacker causes the stored dangerous file to be processed by the server (for example, by requesting the uploaded artifact), resulting in execution of the embedded content and, per the NVD description, execution of arbitrary system commands on the host.

5. Post-exploitation impact. With arbitrary command execution in the application server's context, an attacker could read or modify application data, harvest credentials and configuration, pivot to backend databases and integrated systems, install persistence, or disrupt the workflow platform. The blast radius extends to any data and downstream systems the Agentflow instance can access.

No specific payload strings, function names, or parameter names are asserted here, as they are not present in the provided intelligence.

Impact Assessment

Per the NVD description, successful exploitation results in execution of arbitrary system commands, i.e., full compromise of the host running Agentflow 4.0. Although NVD did not assign a CVSS score in the supplied data (Score: N/A; Vector: N/A), the vulnerability class and stated impact map to a high-severity profile:

• Confidentiality (High): command execution allows exfiltration of application data, configuration, and secrets accessible to the service account.
• Integrity (High): attacker can alter files, data, and possibly application logic.
• Availability (High): attacker can terminate services, delete data, or render the platform inoperable.
• Privileges Required (Low): exploitation requires only an authenticated account.
• User Interaction (None): the attacker initiates the upload directly.

Affected systems: Flowring Agentflow 4.0 deployments running versions earlier than the 2023/03/24 fix are presumed affected. Because this product is commonly deployed as an internal workflow/BPM hub, blast radius frequently includes HR, finance, and process-approval data and the backend systems Agentflow integrates with (databases, file shares, mail, ERP/CRM connectors).

Business impact: unauthorized command execution on a workflow platform can translate to lateral movement into corporate networks, data breach, regulatory exposure, and operational downtime. The requirement for authentication reduces mass internet exploitation but does not reduce severity for exposed portals with many user accounts.

Detection Guidance

Detection should focus on: (1) upload requests to /WebAgenda/download/uploadFile.jsp carrying executable/script file types, and (2) subsequent file-write and process-execution activity on the Agentflow host consistent with a dropped web shell or command payload.

Sigma Rule

title: Suspicious File Upload to Flowring Agentflow uploadFile.jsp
id: 6f4f2c9a-1c2e-4a0b-9d3f-aa1c96431001
status: experimental
description: Detects POST requests to the Flowring Agentflow WebAgenda upload endpoint with dangerous file extensions (CVE-2026-96431)
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection_uri:
    cs-uri-stem|endswith: '/WebAgenda/download/uploadFile.jsp'
  selection_method:
    cs-method: 'POST'
  selection_ext:
    cs-uri-query|contains:
      - '.jsp'
      - '.jspx'
      - '.war'
      - '.java'
      - '.sh'
      - '.exe'
  condition: selection_uri and selection_method and selection_ext
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrative uploads of script files to the Agentflow platform
level: high

YARA Rule

rule CVE_2026_96431_Agentflow_Upload
{
    meta:
        author = "valtersit.com"
        description = "Detects Flowring Agentflow WebAgenda malicious upload artifacts (CVE-2026-96431)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96431"
        date = "2026-01-01"
    strings:
        $a = "/WebAgenda/download/uploadFile.jsp" ascii nocase
        $b = "WebAgenda" ascii nocase
        $c = "Agentflow" ascii nocase
        $d = "Runtime.getRuntime().exec" ascii
    condition:
        ($b or $c or $a) and $d
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96431 Flowring Agentflow uploadFile.jsp suspicious upload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/WebAgenda/download/uploadFile.jsp"; http.uri; nocase; http.request_body; content:"filename="; nocase; pcre:"/filename=\"[^\"]+\.(jsp|jspx|war|sh|exe)\"/i"; classtype:web-application-attack; sid:9643101; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where http.request.method == "POST" and url.path endswith "/WebAgenda/download/uploadFile.jsp" ]
  [ file where event.action in ("creation", "modification") and file.extension in ("jsp","jspx","war","sh","exe") ]

Splunk SPL Query

index=web OR index=proxy
| search uri_path="/WebAgenda/download/uploadFile.jsp" http_method=POST
| eval suspicious_file=if(match(uri_query, "(?i)\.(jsp|jspx|war|sh|exe)") OR match(form_data, "(?i)filename=.*\.(jsp|jspx|war|sh|exe)"), "yes", "no")
| where suspicious_file="yes"
| stats count values(src_ip) as source_ips values(user) as users earliest(_time) as first_seen latest(_time) as last_seen by uri_path

Wazuh OSSEC Rule

<group name="web,agentflow,cve-2026-96431,">
  <rule id="964310" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <url>/WebAgenda/download/uploadFile.jsp</url>
    <regex>POST</regex>
    <regex>\.(jsp|jspx|war|sh|exe)</regex>
    <description>CVE-2026-96431: Suspicious file upload to Flowring Agentflow uploadFile.jsp</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or advisory was present in the supplied data.

1. Immediate mitigations

   • Restrict network access to the Agentflow instance and, specifically, to the /WebAgenda/download/ path, to trusted networks/users. Block external reachability of uploadFile.jsp at the reverse proxy or WAF where operationally feasible.
   • Deploy an allow-list-based upload inspection control (WAF or proxy rule) that rejects requests carrying dangerous extensions/MIME types (for example .jsp, .jspx, .war, .sh, .exe) to uploadFile.jsp.
   • Ensure the upload storage directory is not web-executable where the platform permits configuration changes (disable script execution in the upload directory at the servlet container or web server layer).
   • Review and reduce the population of authenticated users, enforce least privilege, and rotate credentials of any low-trust accounts.

2. Patch / upgrade steps

   • Contact Flowring to obtain the fixed Agentflow 4.0 build (the NVD description cites the 2023/03/24 threshold as the fix date). Verify the build date of the deployed instance against this threshold.
   • If a vendor build cannot be obtained, escalate to the vendor/partner for a supported remediation path; do not rely on custom code changes to vendor binaries without vendor validation.
   • Apply any vendor-issued interim configuration guidance if later published.

3. Long-term hardening

   • Enforce strict server-side upload validation (extension and content-type allow-listing, content inspection) and store user uploads outside the web root.
   • Segment the Agentflow host from sensitive backend systems; apply least-privilege service accounts.
   • Centralize web access, file-creation, and process-execution logging and alert on the detections above.
   • Monitor NVD and Flowring channels for an official patch/CVE advisory and upgrade as soon as one is available; re-assess patch confidence once vendor evidence emerges.

References

• NVD — CVE-2026-96431: https://nvd.nist.gov/vuln/detail/CVE-2026-96431
• MITRE CWE-434 — Unrestricted Upload of File with Dangerous Type: https://cwe.mitre.org/data/definitions/434.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (no score currently assigned): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-96431 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, or exploit-in-the-wild activity is associated with this CVE in the supplied dataset. No threat actor campaign attribution is available.